feat(release): per-constituent semantic diff between agent releases

[gibbsie]

Summary

Agent releases are immutable, content-addressed bundles - but when an approver signs off on a promotion today, they see the candidate's identity, not what actually changed against the release currently serving the target environment. Answering "what exactly am I approving?" means manually comparing constituents across stores. This adds a first-class semantic diff and puts it in front of the approver.

What changed

• Pure diff module (utils/release-diff.ts): per-constituent semantic diff - agent config, prompt text (Line-level LCS diff, implemented locally, no new dependency), model id/params, tool list additions/removals, policy config field deltas, and eval-evidence delta including per-dimension score-vector movement. Enumerates every changed constituent with before/after; unchanged constituents are omitted; per-constituent output is truncated at 256KB with an explicit flag; the function never throws.
• Exhaustiveness guard: a satisfies Record<keyof ...› coverage map makes any future bundle constituent a compile error if the diff doesn't handle it, backed by a runtime missing-key check - a newly added constituent cannot silently escape the diff while still being covered by the release's content hash.
  -*releaseDiff(releaseIdA, releaseIdB) GraphQL query: read-only, org-scoped (cross-org requests rejected), served by a dedicated Least-privilege Lambda (GetItem on two tables, nothing else).
• Approval embedding: when a promotion approval is written, the candidate-vs-current-stable diff is embedded additively in the approval record - capped at 256KB for the whole payload with a truncated stub, and strictly best-effort: an approval can never fail because of its diff.
• UI: no release-detail surface exists yet, so this is API-only for now (documented in the release runbook, consistent with the epic's interim pattern).

Testing

• Property-based (fast-check): 'diff(a, a) is empty for arbitrary bundles; diffs are symmetric-inverse - diff(a, b) and diff(b, a) enumerate the same constituents with before/after swapped (this property caught a real structural asymmetry in the tools diff during development).
• Per-constituent coverage tests including score-vector movement; oversized approval test (2,000 changed prompts pushing past the whole-payload cap - approval still succeeds and embeds the truncated stub); exhaustiveness-guard tests (missing-key rejection, superset-input tolerance); cross-org rejection.
• tsc --noEmit clean; full backend suite green (6,548 tests); synth clean for both affected stacks.

Deployment notes

Adds one read-only Lambda with a two-table GetItem role, plus GraphQL schema additions. Light infrastructure delta; the usual pre-merge branch deploy to dev applies.